CRITICAL🇵🇱 Wersja polska

CVE-2025-14307

CVSS 9.3v4.0pub. 2025-12-09upd. 2026-01-05

An insecure temporary file creation vulnerability exists in the AutoExtract component of Robocode version 1.9.3.6. The createTempFile method fails to securely create temporary files, allowing attackers to exploit race conditions and potentially execute arbitrary code or overwrite critical files. This vulnerability can be exploited by manipulating the temporary file creation process, leading to potential unauthorized actions.

🇵🇱 Read Polish description →

🤖 AI Analysis

How it works

The vulnerability results from improper implementation of temporary file creation (CWE-377 — Insecure Temporary File). There is a time window between checking the availability of a temporary file name and its actual creation, which an attacker can exploit to substitute their own file at the predictable path. By manipulating this process, a local user with limited privileges can trick the application into reading or writing a file substituted by them, which can consequently lead to arbitrary code execution or destructive file overwriting.

Impact

An attacker with local access to the system can execute arbitrary code in the context of the Robocode process or overwrite critical system files, potentially gaining higher privileges or causing system damage.

Mitigation & patch

Patches available from the vendor should be applied according to the references. A fix is available as a pull request in the project repository: https://github.com/robo-code/robocode/pull/68. Until updating, it is recommended to restrict local access to systems running Robocode.

Who is affected

Robocode version 1.9.3.6 (AutoExtract component).

Analysis generated by Claude AI (Anthropic) based on NVD data. Always verify with vendor.

CVSS Vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:D/RE:M/U:Red